Description

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-16T14:16:57.727Z",
  "pubdate": "2026-08-16T14:16:57.727Z",
  "executiveSummary": "OpenTofu before 1.11.7 contains an insecure symlink validation vulnerability within the provider cache directory initialization process. This security flaw enables threat actors to achieve arbitrary file write capabilities outside of the designated working tree, potentially leading to system compromise, arbitrary file overwriting, or privilege escalation. The vulnerability affects the OpenTofu infrastructure-as-code automation tool across systems utilizing untrusted or shared working directories. Risk implications are severe, as successful exploitation allows local attackers with the ability to place malicious symlinks within a trusted working directory to leverage the execution privileges of the user running the initialization command. Attackers require local access to plant the malicious symlink structure within the repository or working directory prior to execution. The exploitation requirement relies on the victim initiating the vulnerable operation within a compromised or maliciously prepared working tree, causing the initialization process to traverse symlinks and write provider package contents to unauthorized filesystem locations.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and sanitization regarding existing symbolic links within the provider cache directory during the execution of the initialization routine. Specifically, the vulnerable component resides in the provider initialization and caching subsystem of OpenTofu before 1.11.7. During the initialization phase, when OpenTofu processes and extracts provider packages into the cache directory, it fails to verify whether destination paths or intermediate directory components contain unvalidated symlinks pointing outside the intended working directory boundary.\nThe step-by-step attack flow initiates when a threat actor creates a malicious symbolic link inside a trusted working directory controlled or influenced by the attacker. This symlink is crafted to point to a sensitive, arbitrary location on the host filesystem where the executing user possesses write permissions. Subsequently, when an authorized user or automated pipeline executes the initialization command within this working directory, OpenTofu attempts to resolve and write provider package contents into the cache structure. Because the application does not validate or restrict symlink targets within the provider cache directory, the file write operations traverse the attacker-supplied symlink.\nConsequently, the payload behavior results in provider binaries, configuration data, or arbitrary package contents being written directly to the target path outside the working tree. Post-exploitation impact depends heavily on the chosen destination path and the privileges of the executing user; however, it can lead to the replacement of critical system binaries, unauthorized modification of configuration files, or arbitrary code execution if the overwritten file is subsequently executed or loaded by the operating system or other applications.\nAuthentication and privilege requirements for this vulnerability dictate that the attacker must have local access to introduce the malicious symlink into the working directory tree. No network exposure is required for direct exploitation, as the vector is entirely local to the filesystem where the initialization command is executed. The affected versions strictly encompass OpenTofu prior to 1.11.7."
}